[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAN_LGv2MKS7C5JZA-PxKhc1M7VA-UTt2ZP05sk3eWKY6YOjo5Q@mail.gmail.com>
Date: Mon, 5 Feb 2024 16:45:55 +0800
From: "Alexander E. Patrakov" <patrakov@...il.com>
To: oss-security@...ts.openwall.com
Cc: Qualys Security Advisory <qsa@...lys.com>, Adhemerval Zanella <adhemerval.zanella@...aro.org>
Subject: Re: Out-of-bounds read & write in the glibc's qsort()
On Mon, Feb 5, 2024 at 4:40 PM Alexander E. Patrakov <patrakov@...il.com> wrote:
>
> On Mon, Feb 5, 2024 at 12:36 AM Solar Designer <solar@...nwall.com> wrote:
>
> > It's so invasive I cannot easily tell whether qsort() remained robust
> > after it or not. There's no longer a "tmp_ptr != base_ptr &&" check.
> > So, lacking known-working tests in glibc tree, we don't know about glibc
> > 2.39's status with respect to this issue.
> >
> > I don't have a glibc 2.39 build handy. Perhaps someone on a distro that
> > has already updated can run the attached test program and let us know?
>
> Here you go: no output on Arch Linux.
>
> [aep@...-haswell tmp]$ gcc ./glibc-qualys-rocky-qsort-test.c
> [aep@...-haswell tmp]$ ./a.out
> [aep@...-haswell tmp]$ /lib64/libc.so.6
> GNU C Library (GNU libc) stable release version 2.39.
> Copyright (C) 2024 Free Software Foundation, Inc.
> This is free software; see the source for copying conditions.
> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
> PARTICULAR PURPOSE.
> Compiled by GNU CC version 13.2.1 20230801.
> libc ABIs: UNIQUE IFUNC ABSOLUTE
> Minimum supported kernel: 4.4.0
> For bug reporting instructions, please see:
> <https://gitlab.archlinux.org/archlinux/packaging/packages/glibc/-/issues>.
>
> --
> Alexander E. Patrakov
Sorry, I should have followed the instructions.
[aep@...-haswell tmp]$ while true; do n=$((RANDOM*64+RANDOM+1));
prlimit --as=$((n*4/2*3)) ./a.out $n; done
This results in a mix of these outputs:
PASSED
./a.out: error while loading shared libraries: libc.so.6: failed to
map segment from shared object
Segmentation fault
--
Alexander E. Patrakov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
